Risk Assessment
We assess your exposure to climate, water, biodiversity and deforestation risk site by site, across your whole value chain, with our own assessment tool. The same analysis then answers CDP, EcoVadis, CSRD, EUDR and your ISO system — and turns into a costed action plan.
Our tool
One assessment engine behind every answer
We built the tool we needed: a single engine that reads your locations, scores them against recognised environmental datasets, and carries each score through to the frameworks that ask for it. Nothing is retyped from one deliverable to the next.
- Declare your scope
Sites, subcontractors and competitors, through three structured forms. Addresses are geocoded and cross-checked against their coordinates. - Find what you have missed
AI-assisted discovery searches the web and official registries (SIRENE, ICPE, OSM, E-PRTR) for locations you did not list, with a confidence score. Anything uncertain goes to a human for validation. - Enrich every location
WRI Aqueduct 4.0 for water, IUCN STAR, WDPA and KBA for biodiversity, Global Forest Watch for forests, ERA5 and CMIP6 for climate, PVGIS and VigiEau for the local picture. Every value keeps its source. - Score risks, opportunities and adaptation
Eight risk categories per location, in current conditions and under SSP scenarios to 2030, 2050 and 2080, with an indicative financial exposure and a costed catalogue of adaptation measures. - Produce the deliverables
Interactive map, mandatory tables, executive deck, action plan with budgets and Gantt, and the A-to-I appendices in Excel, Word, PDF and a browsable HTML explorer.
Scope
The whole value chain, not only your own sites
Raters and regulators no longer accept an assessment that stops at the factory gate. Every risk we score carries the value chain stage where it occurs, in the exact wording CDP and the ESRS expect.
Direct operations
- Every site scored on water, climate, biodiversity, forests, regulatory, operational and social risk
- Asset value, headcount, water and energy consumption, strategic importance
- Local regulations attached site by site, country by country
Upstream value chain
- Subcontractors and suppliers scored on their own locations, not on a questionnaire
- Weighted by criticality, annual spend and single-sourcing
- Risk materials traced for the EUDR: plot geolocation, legality, due diligence
Downstream value chain
- Products and customers exposed to transition risk and to buyer requirements
- Customer-driven requirements, including large-buyer supplier programmes
- Transport, distribution and end-of-life where they drive the exposure
What your market is publishing
- The tool also runs documentary monitoring on your company and your competitors: SIRENE identity and published turnover, CSR and sustainability reports, financial reports, codes of conduct and vigilance plans, GHG inventories, CDP and EcoVadis scores, SBTi targets checked against the official dashboard. Each finding is stored with a supporting quote and its source. Competitors you have not named are proposed, never imposed.
Interactive example
Explore a complete assessment
Below is a full assessment as the tool produces it: a fictitious specialty-chemicals group with six sites, three subcontractors and two competitors. Change the entity, switch to an SSP scenario and a horizon, then click any category to see the factors behind the score and the frameworks it feeds.
Click a category to see the underlying factors
Referential bridges
Fictitious data: a specialty-chemicals group invented for this demonstration. The scores come from the tool, not from a real client. SSP scenarios move water and climate only; the other categories are assessed as they stand today.
Continuity case
A continuity break, developed end to end
One risk, followed from the hazard to the premium and then to the disclosure. This is the shape every risk takes in the assessment: how it develops, what it costs, what it costs to insure, and the exact line it fills in the ESRS and in CDP.
How the risk develops
Water scores 5.0 out of 5 here today, and it stays at 5.0 under every SSP pathway out to 2080. This is not a future risk you plan for; it is a present one you are already carrying. Underneath: water stress 4.6/5, seasonal variability 4.3/5, drought 4.0/5, flood 3.9/5.
The regulatory layer is attached to the site, not to the group: the plant draws under a CONAGUA concession (Ley de Aguas Nacionales). When a restriction period opens, industrial allocation is the first to be cut — before agriculture, before households. That is the trigger, and it is administrative, not meteorological.
- Allocation cut
- Process flow drops
- Lines stop partially
- Downstream customers go short
- Contract penalties and de-listing
Nothing in that sequence is unusual. What the assessment adds is that each link carries a number, a source and a date — so the sequence can be priced, insured, and argued in front of a board.
From hazard to a number
| Step | Value | Where it comes from |
|---|---|---|
| Hazard | Water stress 4.6/5 · variability 4.3/5 · drought 4.0/5 · flood 3.9/5 | WRI Aqueduct 4.0, per location |
| Sensitivity | Strategic importance 4/5, water-intensive process | Declared by you, weighted with the ENCORE sector dependencies |
| Water score | 5.0 / 5 — capped, unchanged from SSP1-2.6 to SSP5-8.5, 2030 to 2080 | hazard × sensitivity, capped at 5 |
| Asset damage — water | €7.2M | €72M × 10% maximum damage ratio × 5.0/5 |
| Asset damage — operational | €7.0M | €72M × 12% maximum damage ratio × 4.07/5 |
| Downtime | 10 days per year | Tool scale: 10 days at a score of 4 or above, 5 days at 3, 2 days at 2 |
| Business interruption | 10 × site revenue ÷ 365 | Site revenue as you declare it; counted for water, climate and operational risk |
| Retained exposure | A min–max range, not a point estimate | Minimum at the most favourable scenario and horizon, maximum at SSP5-8.5 2080 |
Every figure above is an order of magnitude for prioritising, to be calibrated with your insurer and your controller. The assessment is explicit about that: the damage ratios and the downtime scale are written down and can be adjusted with you — they are assumptions, not measurements.
What it changes with your insurer
Premium, deductible and business-interruption sub-limit are the three variables. The assessment does not price them — it supplies the two inputs that determine them, per site rather than per group, with the mitigation plan and its dates attached.
| Insurance item | In the demonstration | What the assessment brings |
|---|---|---|
| Declared values | €72M insurable value at this site | Value, headcount and consumption per location, not a single group total |
| Annual premium | €310k across the industrial programme | The hazard, dated and sourced (Aqueduct, CMIP6), instead of a claims history |
| Deductible | €1M per claim | A damage range per hazard, so the deductible can be set against the right one |
| BI sub-limit | €5M — the weak point, against €7.2M of exposure and 10 days of stoppage | The downtime estimate and the revenue at risk, per site and per hazard |
| Drought exclusions | To be read line by line in the policy | Which hazard actually drives the score here, so the exclusion is checked against it |
| Price of the plan | Adaptation measures costed and ranked by effect over cost | What the premium should do once the plan is executed — the argument to take to the broker |
Read the demonstration figures as an illustration of the arbitrage, not as a quotation. In this case the sub-limit is the weak point, not the premium — and that is the kind of conclusion that only appears once the exposure is computed site by site.
The same case, written as ESRS
| What the assessment produces | ESRS datapoint |
|---|---|
| The interaction between this risk and the business model | ESRS 2 SBM-3 |
| The process used to identify and assess it, with horizons and locations | ESRS 2 IRO-1 |
| Assets at material physical risk and the monetary amounts | ESRS E1-9 |
| Resilience of the strategy and the transition plan | ESRS E1-1 |
| Anticipated financial effects from water-related risks | ESRS E3-5 |
| Actions, resources and budgets | ESRS E1-3 · E3-2 |
| Water targets and their baseline | ESRS E3-3 |
The same case, written as CDP
| What the assessment produces | CDP question |
|---|---|
| Risk register: hazard, timeframe, substantive effect | 3.1.1 |
| Financial amount vulnerable, as a min–max range | 3.1.2 |
| Opportunities and expected benefit | 3.6.1 |
| Scenario analysis, horizons and results | 5.1.1 · 5.1.2 |
| Assessment process, time horizons, priority locations | Module 2 — 2.2 |
| Withdrawals, discharges, facilities in stressed areas, water targets | Module 9 — target 9.15 |
| Board oversight and management responsibility for the risk | Module 4 |
| Verification, sources and dates behind every value | Module 13 |
Why this sits inside your strategy, not beside it
A risk assessment that lives in its own document gets read once. This one is built to graft onto what you already run: the site goes into the insurance programme, the exposure into the business plan, the mitigation into the ISO 14001 improvement programme, the numbers into CDP and the ESRS, and the decision into the committee that was going to meet anyway. One assessment, one set of figures, and every function reading its own line of it — that is the link the system is there to create.
Method
How a score is built
A risk score is a hazard multiplied by a sensitivity, capped at 5. The hazard comes from the datasets, on a 0 to 5 scale. The sensitivity comes from your sector — through the ENCORE dependency framework — and from the strategic importance you give the site. No judgement is hidden in the number.
Weights in the overall score
- Water 25 %
- Climate 20 %
- Biodiversity 15 %
- Operational 15 %
- Regulatory 10 %
- Supply chain 10 %
- Forests 5 %
- Social reported separately
Scenarios and horizons
- SSP1-2.6, SSP2-4.5 and SSP5-8.5, at 2030, 2050 and 2080
- IPCC AR6 and CMIP6 for climate, Aqueduct 4.0 projections for water
- A stress test at SSP5-8.5 drives the adaptation plan
- RCP 2.6 / 4.5 / 8.5 restated through their SSP equivalents
Adaptation
Any category reaching 3 out of 5, in the reference scenario or in the SSP5-8.5 stress test, opens the adaptation catalogue, following ISO 14090 and ISO 14091. Measures are ranked by score, effectiveness and strategic importance, divided by cost, with a bonus for no-regret measures. Avoided losses are weighted by probability and capped per site and per hazard, so nothing is counted twice.
Every parameter is written down and can be changed with you. Financial exposure is indicative: it sizes the subject, it does not replace your own valuation.
Bridges
Answer labels and regulations from the same analysis
This is where the time is saved. Each risk, each scenario and each action already carries the referential it serves and the link that justifies it — which CDP question, which ISO 14001 clause, which EcoVadis criterion, which ESRS datapoint. Answering a questionnaire becomes an export, not a new project.
The tool estimates your CDP level before and after the plan, module by module, maps ISO 14001 clause by clause from 4.1 to 10.3 with its PDCA rhythm, and fills the CDP risk tables (3.1.1, 3.1.2, 3.6.1), the scenario fields (5.1.1, 5.1.2) and the targets (7.53.1, 7.54.1, 7.54.3, 9.15, modules 8 and 11).
- CDP Climate · Water · Forests
- EcoVadis — 14 criteria
- ISO 14001
- ISO 14090 / 14091
- ISO 14046
- AWS Standard
- CSRD / ESRS
- GRI
- TCFD
- TNFD
- CSDDD
- EUDR
- SBTi and SBTi FLAG
- GHG Protocol / ISO 14064-1
- Microsoft supplier requirements
Behind all of this sits a global referential of 147 instruments — regulations, labels, standards and certifications — each recorded once and linked to the jurisdictions where it applies. Appendices A to I give you the inventory, the instruments that apply to each company and site, the risk / scenario / trajectory / instrument matrix, the evidence and quotes, the gap analysis, the prioritisation matrix, the trajectories and indicators, the register of sources and assumptions, and the consolidated action plan.
Annex extract
The correspondence tables, as the tool produces them
Every assessment ships with annexes A to I — the compliance tables. They are the part clients reuse the most: the inventory of instruments, the ones that apply to each company and each site, the risk / scenario / trajectory / instrument matrix, the evidence and quotes, the gap analysis, the prioritisation, the trajectories and indicators, the register of sources and the consolidated plan. Two of them are reproduced live below, on the real referential: which obligations apply to a sector in a jurisdiction, and where a sectoral standard answers a regulation. Pick a sector and a country — the tables are rebuilt from the same referential the deliverables use.
Annex A extract — regulatory obligations in scope
| Instrument | Jurisdiction | Applies because | Workstreams it triggers |
|---|
Annex C extract — where a sectoral standard answers a regulation
| Workstream | Required by | Structured / evidenced by | Referential mapping | Evidence indicator |
|---|
Sector-specific standards and labels
Obligations are kept apart from voluntary schemes. No certification is said to reduce a risk: the mapping states what the scheme structures or evidences.
Extract from the annexes the tool produces. The full Annex A carries 19 columns per instrument (issuing body, thresholds, deadlines, procedure, validity, official source, verification date, confidence and limits); Annexes B to I add the per-site view, the evidence and quotes, the gap analysis, the prioritisation matrix, the trajectories and the consolidated action plan. Applicability is shown as likely and is confirmed with you — it is never asserted for every entity.
Deliverables
Four levels of reading, one analysis
The same assessment is restated for four audiences. Nobody has to read someone else’s document to find their own answer.
01
Executive committee
Five slides: the exposure, what is at stake financially, the decision asked for and the budget envelope. No methodology, no jargon.
02
Management committee
Dashboard, risk matrix, priorities by site, budget and ROI, 0-12 month, 1-3 year and 3-10 year roadmap, SWOT and top ten risks.
03
Technical teams
Seven themes in three passes each — in plain terms, in detail, referential risks — with the per-site tables, the factors behind every score and the source of every value.
04
Operational teams
One sheet per action: objective, means, FTE, CAPEX share, recurring OPEX, duration, prerequisites, what it changes day to day, residual risk, ISO clause, CDP question, owner. Scheduled over 30 working days, 12 weeks and a 36-month budget, with a Gantt chart.
Our philosophy
Risk work that completes the business plan
An assessment that ends in a report changes nothing. Ours is a system that grafts onto the strategy you already have: it ends in workstreams, owners, budgets and dates — because quality, management systems, governance, risk and ESG are one subject, and your business plan is where they have to meet.
We align what already exists rather than adding a layer on top: your ISO system gives the rhythm and the evidence, your governance gives the decisions, the risk analysis gives the priorities, and the ESG frameworks give the proof your customers and investors ask for. What comes out is work your teams can actually schedule, with the budget and the return written next to it.
Every analysis is reviewed by a consultant before it reaches you. The tool produces, we answer for it.
Services
Three scopes, one method
The same engine, the same annexes, the same deliverables — what changes is how far out the assessment reaches. Start where the pressure is, extend when it pays.
Risk Assessment — Direct Operations
Your own sites, scored on the eight risk categories, current conditions and SSP scenarios to 2030, 2050 and 2080, with the adaptation catalogue and the local regulations attached site by site. The fastest route to a CDP response and an ISO 14001 context that holds up.
Risk Assessment — Value Chain
Direct operations plus upstream and downstream: suppliers and subcontractors scored on their own locations rather than a questionnaire, EUDR materials traced to the plot, and the customer requirements that come back down the chain. The scope CSRD, CSDDD and EUDR actually ask for.
Risk Assessment — Overall
The whole value chain plus your competitors: public reports, CDP and EcoVadis scores, verified SBTi targets and published commitments, each kept with its evidence quote. You see where you stand before a customer or an investor tells you.
Talk to us about Risk Assessment
Tell us where you stand and what deadline you face. A consultant will reply to you personally.
Deliverables can be translated into your language. Debrief sessions are held in English or French.